User identification is a common functionality of both online services and offline systems. A crucial aspect of user identification is security. A common way to identify a user is to assign the user a unique identifier that is paired with a password. User access is granted only to someone who can present a valid pair of a unique identifier and a password.
It is a challenging task to ensure that a password provides a sufficient level of security. One method to increase the security of a password is obligating a certain minimum length and enforcing the use of compound combinations of character classes (such as lowercase, uppercase, numerical, and symbols). Such an approach makes it harder for an attacker to correctly guess the password in a finite amount of time without significant computational resources. Another security method, known as password aging, assigns an expiration date to a password and requires that the user change his or her password on a regular basis. This technique helps preclude that a compromised password will be used for any extended time period. All of these techniques promote cryptographically better passwords, but they also hinder everyday use.
It is desirable to provide alternative methods that address the drawbacks of regular password-based authentication methods and that enable robust and secure access to protected resources.